US 6996562 B2 Abstract Given a language with all words in a fixed length, and a set of regular expressions composed only from characters in the alphabet of the language or the ? sign (any single character), the method of the invention defines a data structure that is used to efficiently find the set of matching regular expressions for a given query word. The method may be adjusted by appropriate selection of a control variable to vary the storage space required and the search time necessary to complete the query. Specifically, the method of the present invention provides a space versus time trade-off between the storage space required for the data structures of the present invention and the amount of time to search those data structures to determine the matching set of regular expressions.
Claims(21) 1. In a language using an alphabet having a first number of characters L forming words of a fixed length W, and a second number N of regular expressions composed only from the characters in the alphabet and the ? sign, a computer implemented method of finding a set of matching regular expressions associated with a given query word, comprising the steps of:
selecting a base B from 1 to W to divide the words of length W into J=W/B groups;
creating a lookup table for each of the J groups, the lookup table for each of the J groups having K=L
^{B }entries, each of the K entries being a bitmap of length N;seeding each lookup table for each regular expression from I=1 to I=N; and
searching each lookup table to determine the set of regular expressions that match the query word.
2. The method of
^{B}, of setting an I^{th }bit in the bitmap in the K^{th }entry true when a value of the J^{th }group of the I^{th }regular expression matches K and when the value of the J^{th }group of the I^{th }regular expression is equal to ?.3. The method of
^{B}, of setting an I^{th }bit in the bitmap in the K^{th }entry true when a value of the J^{th }group of the I^{th }regular expression and its mask matches K and when the value of the J^{th }group of the I^{th }regular expression and its mask is equal to ?.4. The method of
creating a result bitmap of length N having each of its bits from I=1 to I=N set true;
dividing the query word into J groups of B characters, each of the J groups having a query value;
determining, for J=1 to J=W/B, an intersection between the result bitmap and the bitmap in the entry corresponding to the J
^{th }query value in the J^{th }lookup table;retrieving the set of regular expressions from I=1 to I=N that correspond to the bits from I=1 to I=N in the result bitmap that are set true.
5. The method of
^{th }query value in the J^{th }lookup table comprises the steps of calculating a logical AND between the result bitmap and the bitmap in the entry corresponding to the J^{th }query value in the J^{th }lookup table, and storing a result of the step of calculating in the result bitmap.6. The method of
7. The method of
8. The method of
9. The method of
10. The method of
11. In a language using an alphabet having a first number of characters L forming words of a fixed length W, and a second number N of regular expressions composed only from the characters in the alphabet and the ?, a computer-readable medium having computer-executable instructions for performing steps, comprising:
selecting a base B from 1 to W to divide words of length W into J=W/B groups;
creating a lookup table for each of the J groups, the lookup table for each of the J groups having K=L
^{B }entries where L is the number of characters in a language of the words, each of the K entries being a bitmap of length N corresponding to a number of regular expressions;seeding each lookup table for each regular expression from I=1 to I=N; and
searching each lookup table to determine a set of regular expressions that match a query word.
12. The computer-readable medium of
^{B}, of setting an I_{th }bit in the bitmap in the K^{th }entry true when a value of the J^{th }group of the I^{th }regular expression matches K and when the value of the J^{th }group of the I^{th }regular expression is equal to ?.13. The computer-readable medium of
^{B}, of setting an I^{th }bit in the bitmap in the K^{th }entry true when a value of the J^{th }group of the I^{th }regular expression and its mask matches K and when the value of the J^{th }group of the I^{th }regular expression and its mask is equal to ?.14. The computer-readable medium of
creating a result bitmap of length N having each of its bits from I=1 to I=N set true;
dividing the query word into J groups of B characters, each of the J groups having a query value;
determining, for J=1 to J=W/B, an intersection between the result bitmap and the bitmap in the entry corresponding to the J
^{th }query value in the J^{th }lookup table;retrieving the set of regular expressions from I=1 to I=N that correspond to the bits from I=1 to I=N in the result bitmap that are set true.
15. The computer-readable medium of
^{th }query value in the J^{th }lookup table comprises the steps of calculating a logical AND between the result bitmap and the bitmap in the entry corresponding to the J^{th }query value in the J^{th }lookup table, and storing a result of the step of calculating in the result bitmap.16. A computer-readable medium having stored thereon a first number J of data structures, the first number J corresponding to a division of a fixed word length W required by a language by a selected base B, each data structure having a second number of data fields K, the second number K corresponding to a third number L of different characters in the language raised to the power of the selected base B, each data field containing a bitmap of length N, where N is equal to a fourth number of regular expressions.
17. The data structures of
18. The data structures of
^{B}, the I^{th }bit in the bitmap in the K^{th }data field is set true when a value of the J^{th }group of the I^{th }regular expression matches K and when the value of the J^{th }group of the I^{th }regular expression is equal to ?, where ? equals any single character in the language.19. The data structures of
20. The data structures of
21. The data structures of
^{B}N.Description The present invention relates to methods of searching for matching expressions, and more particularly to methods of searching for matching regular expressions in fixed word length languages such as may define policy rules implemented by gateways firewalls, proxies, routing tables, etc. In computerized systems and networks the control of data and packet flow between users in the network and the outside world often provides a first line of defense against malicious nodes, and provides a measure of administrative control. Gateways, firewalls, proxies, and network address translators (NAT) etc. are all devices which allow a network administrator to institute various policies and rules that, at least to some extent, provide the control of data and packet flow therethrough. The rules that reflect the administrative policy are typically associated with a packet's source address, destination address, port information, etc., and can designate applicability to groups of addresses to allow communication policy to be applied to nodes within a subnet. Once the administrator of the policy builds the set of rules or regular expressions to be applied to the packet flow through the network device, these rules are typically placed in a database for retrieval and use by the device. As each packet is processed through the gateway, firewall, etc., the device must check the database to find any and all applicable rules that apply to that packet. Such rules may simply relate to the proper routing of that packet, or may be restrictive in nature, disallowing packet flow between certain addresses or from certain nodes. Once the device has found the applicable rules, these rules are then applied to decide what to do with the packet. As the size of the network grows and the throughput of information increases, the processing time required to locate and apply these rules may result in information flow delay caused by the gateway device. This lag in processing time may become unacceptably long, especially as the number of rules and the volume of communication traffic increases. In the firewall example, a major component of this processing lag is the search time associated with finding which rules apply to particular IP addresses. While the current IP address system (the dotted quad) provides for 2 Therefore, there exists a need in the art for a method for efficiently searching a data set of fixed length words to find a set of matching regular expressions. In view of the above, the present invention provides a method for efficiently searching a data set of fixed length words to find the set of matching regular expressions associated therewith. In particular, given a language with all words in a fixed length, and a set of regular expressions composed only from characters in the alphabet or a wild card (any single character), the method of the present invention defines a data-structure that efficiently finds, i.e. with a small number of instructions, the set of matching regular expressions to the given word. The method of the present invention may be optimized by varying the number and size of the lookup table data structures created to reduce the search time or the memory usage as required for a particular application. In an initialization phase of one embodiment of the present invention, the method creates a number of lookup tables related to a selected division of the regular expression word. That is, given the length of the regular expression word W, that word is divided into groups of B length, which results in the creation of W/B groups. Each such group is then given its own lookup table. The number of entries in each lookup table is determined by the number of characters L in the alphabet being utilized, e.g. a binary alphabet has L=2, raised to the power B, i.e. L When a query is received, for example when a packet is received having a source address and destination address, the lookup tables are searched to determine if a regular expression exists that should be applied to that particular packet. The search process begins with the creation of a result bitmap of a length N, where each of the N bits indicates the applicability of one of the 1 to N regular expressions. Initially each of the N bits are turned on in the result bitmap. The search method then determines the intersection between the result bitmap and each of the lookup tables generated during the initialization phase. Specifically, a logical AND operation is performed between the result bitmap and the bitmaps in the entry in the lookup table associated with the information in the received packet. The result from this first logical AND operation is then stored in the result bitmap. This result bitmap is then logically ANDed with the next lookup table and the results stored in the result bitmap. This process continues with each associated entry in each of the lookup tables. Once this process is complete the result bitmap is used to return the set of regular expressions corresponding to the bits which remain turned on in the result bitmap. Through the method and with the data structures of the present invention, an optimization or selection can be made with regard to the amount of storage space required versus the look-up time to resolve the associated regular expressions for a particular query. That is, through proper selection of the grouping variable B, the method of the present invention may be optimized to minimize the amount of space required for the lookup tables by selecting B=1. That is, if each character of the query word is given its own lookup table, the amount of space required to store all the lookup tables and the bitmaps therein is minimized. However, the number of operations that must be performed to search each of the W lookup tables is maximized. For example, 32 separate lookup tables, and therefore 32 separate logical AND operations must be performed if the word length is 32 bits, as is the case with a dotted quad IP address in the binary language. The method of the present invention may also be optimized for a minimal search time, recognizing the trade-off with respect to the amount of space required to store the lookup table to reduce the number of operations to a minimum. In its limit, the grouping B is selected to be equal to the world length W, thereby requiring only a single lookup table. However, while only a single logical AND operation is required to determine which regular expressions are to be associated with a particular query word, the amount of space required to store the single lookup table is maximized. For example, such a lookup table for a 32 bit IP address will require 2 In a language using an alphabet having a first number of characters L forming words of a fixed length W, and a second number N of regular expressions composed only from the characters in the alphabet and the ? sign, the invention provides a method of finding a set of matching regular expressions associated with a given query word. In one embodiment this method comprises the steps of selecting a base B from 1 to W to divide the words of length W into J=W/B groups and creating a lookup table for each of the J groups. The lookup table for each of the J groups has K=L Preferably, the step of seeding comprises the steps, for each regular expression from I=1 to I=N, for each lookup table from J=1 to J=W/B, and for each entry from K=1 to K=L 1. (0==?) 2. (0==0) 3. (1==1) 4. (1==?) 5. (0==0) 6. (1==1) 7. (0==0) 8. (1==?) A character comparison is true either if the characters are equal or if the character from the regular expression is ?. In the above example, the comparisons numbered 2, 3, 5, 6, and 7 are considered equal because the characters are equal, and the comparisons 1, 4, and 8 are equal because the regular expression's character is ?. The K index is considered matched if all characters are equal. Therefore, in this example K=53 is considered equal to ?01?010. In one embodiment the step of searching comprises the steps of creating a result bitmap of length N having each of its bits from I=1 to I=N set true, dividing the query word into J groups of B characters, each of the J groups having a query value, determining, for J=1 to J=W/B, an intersection between the result bitmap and the bitmap in the entry corresponding to the J In an embodiment of the present invention, the step of selecting the base B from 1 to W comprises the step of selecting the base B to minimize a time required to perform the step of searching each lookup table to determine the set of regular expressions that match the query word. Preferably this step selects B to be equal to W. Alternatively, the step of selecting the base B from 1 to W comprises the step of selecting the base B to minimize an amount of memory required to store the J lookup tables. In an embodiment this step selects B to be equal to 1. In a still further embodiment, the step of selecting the base B from 1 to W comprises the step of selecting the base B to balance a memory storage space versus search time inverse relationship for a particular application. In an alternative embodiment of the present invention, a computer-readable medium having computer-executable instructions for performing steps is presented. The steps comprise selecting a base B from 1 to W to divide words of length W into J=W/B groups, and creating a lookup table for each of the J groups. The lookup table for each of the J groups have K=L Preferably, the computer-executable instructions for seeding comprise the steps, for each regular expression from I=1 to I=N, for each lookup table from J=1 to J=W/B, for each entry from K=1 to K=L In one embodiment the computer-executable instructions for searching comprise the steps of creating a result bitmap of length N having each of its bits from I=1 to I=N set true, dividing the query word into J groups of B characters, each having a query value, determining, for J=1 to J=W/B, an intersection between the result bitmap and the bitmap in the entry corresponding to the J In a further embodiment of the present invention, a computer-readable medium having stored thereon a first number J of data structures is presented. This first number J corresponds to a division of a fixed word length W required by a language by a selected base B. Each data structure has a second number of data fields K corresponding to a third number L of different characters in the language raised to the power of the selected base B. Each data field contains a bitmap of length N, where N is equal to a fourth number of regular expressions. In one embodiment each bit of the bitmap in each data field is set false. Further, for each regular expression from I=1 to I=N, for each data structure from J=1 to J=W/B, for each data field from K=1 to K=L In one embodiment the base B is selected to be equal to 1 to minimize an amount of memory required to store the data structures. Alternatively, the base B is selected to be equal to W to maximize an amount of memory required to store the data structures. Further, the amount of memory required to store the data structures is at least equal to (W/B)L Additional features and advantages of the invention will be made apparent following detailed description of illustrative embodiments, which proceeds with reference to the accompanying figures. While the appended claims set forth the features of the present invention with particularity, the invention, together with its objects and advantages, may be best understood from the following detailed description taken in conjunction with the accompanying drawings of which: Turning to the drawings, wherein like reference numerals refer to like elements, the invention is illustrated as being implemented in a suitable computing environment. Although not required, the invention will be described in the general context of computer-executable instructions, such as program modules, being executed by a personal computer. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform particular tasks or implement particular abstract data types. Moreover, those skilled in the art will appreciate that the invention may be practiced with other computer system configurations, including hand-held devices, multi-processor systems, microprocessor based or programmable consumer electronics, network PCs, minicomputers, mainframe computers, and the like. The invention may also be practiced in distributed computing environments where tasks are performed by remote processing devices that are linked through a communications network. In a distributed computing environment, program modules may be located in both local and remote memory storage devices. The invention is operational with numerous other general purpose or special purpose computing system environments or configurations. Examples of well known computing systems, environments, and/or configurations that may be suitable for use with the invention include, but are not limited to, personal computers, server computers, hand-held or laptop devices, multiprocessor systems, microprocessor-based systems, set top boxes, programmable consumer electronics, network PCs, minicomputers, mainframe computers, distributed computing environments that include any of the above systems or devices, and the like. The invention may be described in the general context of computer-executable instructions, such as program modules, being executed by a computer. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform particular tasks or implement particular abstract data types. The invention may also be practiced in distributed computing environments where tasks are performed by remote processing devices that are linked through a communications network. In a distributed computing environment, program modules may be located in both local and remote computer storage media including memory storage devices. With reference to Computer The system memory The computer The drives and their associated computer storage media discussed above and illustrated in The computer When used in a LAN networking environment, the personal computer In the description that follows, the invention will be described with reference to acts and symbolic representations of operations that are performed by one or more computers, unless indicated otherwise. As such, it will be understood that such acts and operations, which are at times referred to as being computer-executed, include the manipulation by the processing unit of the computer of electrical signals representing data in a structured form. This manipulation transforms the data or maintains it at locations in the memory system of the computer, which reconfigures or otherwise alters the operation of the computer in a manner well understood by those skilled in the art. The data structures where data is maintained are physical locations of the memory that have particular properties defined by the format of the data. However, while the invention is being described in the foregoing context, it is not meant to be limiting as those of skill in the art will appreciate that various of the acts and operation described hereinafter may also be implemented in hardware. As discussed above, the method and data structures of the present invention find particular applicability in computing devices that are required to find and apply an appropriate rule or policy under certain circumstances or to meet appropriate criteria. Such devices include, but are not limited to, network gateways, firewalls, proxy servers, network address translators (NAT), or other devices that use routing tables or policy rules that are applied to packets passed therethrough. However, the methods and data structures of the present invention also find applicability in computing devices that need to perform efficient searches based on a search criteria, and in which the efficiency relates to either storage space or search time, or both. Despite this broad applicability of the methods and data structures of the present invention, the following description will provide working examples to aid in the understanding of the present invention. While these working examples will, in the interests of brevity, only describe a single operating environment, to wit a routing table example, such examples shall not be taken as limiting the scope of the invention in any way. As will become apparent from the following description, the methods and data structures of the present invention are particularly well suited for computer environments that use a language of fixed word length, and in which a set of regular expressions are composed from the language's alphabet and the ?, i.e. any single character. In this computing environment the set of regular expressions are associated with or are applied to particular words of the fixed word length. The methods and data structures of the present invention are used to return the set of matching regular expressions for a given query word. In a routing table implementation, the fixed word length may be 32 bits, corresponding to the binary implementation of a source IP address, destination IP address, etc. The regular expressions, therefore, may be the rules that apply to govern the processing of packets from a given source or particular destination addresses. Once the given routing rules or regular expressions have been determined and associated with the criteria of source address or destination address, they are stored in a database for retrieval and application to packets that are received or that are to be processed through the network device. The methods and data structures of the present invention, therefore, are used to provide an efficient searching mechanism to locate the appropriate set of rules or regular expressions to be applied to any and all packets received at the network device. Once the regular expressions or policy rules have been written, the method of the present invention operates in an initialization phase to generate a number of data structures that will be used for the efficient searching for the set of matching regular expressions for each particular packet. A simplified flow diagram of this initialization phase is illustrated in In step The seeding process of the initialization phase is illustrated in the simplified flow diagram of The actual seeding takes place as a match function illustrated as decision block 1. (0==?) 2. (0==0) 3. (1==1) 4. (1==?) 5. (0==0) 6. (1==1) 7. (0==0) 8. (1==?) A character comparison is true either if the characters are equal or if the character from the regular expression is ?. In the above example, the comparisons numbered 2, 3, 5, 6, and 7 are considered equal because the characters are equal, and the comparisons 1, 4, and 8 are equal because the regular expression's character is ?. The K index is considered matched if all characters are equal. Therefore, in this example K=53 is considered equal to ?01?010. If either of these two criteria is satisfied, then the step At this point, the decision block Once this initialization phase has been completed, the method of the present invention may be utilized to efficiently find all of the regular expressions that are associated with or which match a given search criteria. Specifically, as illustrated in the simplified flow diagram of For example, in the alphabet {0,1}, assuming B=8 and a query word 00101010101000101001001010101100, in the first iteration the method obtains 00101010 and the index is 42. In the second iteration, the method obtains 10100010 and the index is 162. In the third iteration, the method obtains 10010010 and the index is 146. Finally, in the fourth iteration, the method obtains 10101100 and the index is 172. The result from this logical AND operation is then stored at step With an understanding of the initialization and search phases of the method of the present invention now firmly in hand, the discussion turns to the space versus time trade-off that results from the selection of the variable B described above. Recognizing that the number of lookup tables J=W/B, that each of these J lookup tables includes K=L Since the differential is always greater than zero (0), it may be seen that the space equation is monotonically increasing with increases in the value of B. That is, the minimal amount of space will be required by the data structures of the present invention when B is selected to be equal to one (1), and will increase as B is increased. This may be seen directly from an examination of the data structures illustrated in The trade-off with respect to the amount of time required to complete the search and location operation of the present invention based on the selection of the variable B must also be considered. Specifically, the total search time is dependent on the time required to perform the logical AND function times the total number of lookup tables for which the logical AND operation must be performed, or total search time equals (W/B)(A) where A equals the amount of time for each logical AND operation. From this equation it can be seen that the total search time decreases as the value of B increases. Since B must be selected to be a natural number between 1 and W, the shortest search time is achieved when B is selected to be equal to W. That is, the shortest search time is achieved when there is only one lookup table, and therefore one logical AND operation to be performed. From the above it may be seen that there is a trade-off between the storage space required for the data structures of the present invention resulting from the selection of B versus the time that it takes to search these data structures. The larger the value for B, the larger the space and the smaller the time, and vice versa. Therefore, the particular selection of a value of B may be tuned for particular applications to satisfy the throughput time requirements with the available space that may be utilized for storage of the data structures. To illustrate the principles described above, the following will provide an example that demonstrates how the method of the present invention behaves on a sample routing table. In this example the alphabet is binary (L=2). In a typical routing table, the route entries are written in the common IP address way that is represented by a dotted quad of format X.X.X.X. With such IP addresses, the fixed word length for the routing table example is 32 bits (W=32). In the following examples, the routing table contains the following entries: 10.76.76.0 mask 255.255.255.0 (A.4C.4C.0 mask FF.FF.FF.0); and 172.31.196.0 mask 255.255.252.0 (AC.1F.C4.0 mask FF.FF.FC.0). In such a routing table example, a query word will be in the form of X.X.X.X (32 bit), and the result will be the set of matching route entries. However, this is only a notation used to make the expression more readable herein. This IP/mask notation can be converted to the regular expression. For example, the expression 00001010.01001100.01001100.00000000 mask 11111111.11111111.11111111.00000000 can be written as 000010100100110001001100????????. In the first example of the data structures created through the method of the present invention illustrated in As the initialization phase proceeds with the second regular expression, the process for seeding each of the bitmaps in each of the lookup tables proceeds in a similar manner to that just discussed. Specifically, the first 8 bits of the second regular expression are equal to 10101100, which results in the second bit of the K=1 entry of the first lookup table being set true, the second bit of the K=0 entry of the J=2 lookup table being set true, etc. This process continues until the twenty-third and twenty-fourth bits are encountered. As indicated above, the third component of the dotted quad address of the second regular expression is equal to 196 mask If a different value of B is selected, for example B=8, the data structures illustrated in During the initialization phase, the regular expression is divided into four groups, which happen to correspond with the dotted quad notation of the IP addresses which simplifies this discussion. Specifically, the initialization of the first lookup table for the first regular expression sets the first bit in the bitmap true in the K=10 entry. The second lookup table is initialized by setting the first bit in the seventy sixth entry true, which is likewise set for the third lookup table. In the fourth lookup table, the value of zero (0) in the regular expression with a mask of zero (0) will result in the first bit of each entry being set true. The initialization for the second regular expression proceeds in similar fashion with the second bit of the bitmap in entry K=172 being set true for the first lookup table. In the second lookup table the second bit in the bitmap in the K=31 entry is set true. In the third lookup table, the value of 196 with a mask value of 252 will result in the second bit of each of the bitmaps in the entries K=196 through K=199 being set true. The mask value of zero (0) for the last lookup table will operate similarly resulting in the second bit of each of the bitmaps in the entries from K=0 to K=255 will be set true. As may be seen from this This search time can be cut in half by the selection of the value for B being equal to 16. The resulting data structures or lookup tables for such a selection for the value of B are illustrated in As the selection of the value for B is taken to its other extreme, that is B=1, only a single lookup table is required. However, this single lookup table includes 2 Once the initialization process discussed above has been completed, the search phase of operation of the method of the present invention may commence. As discussed above, this search phase of operation begins by constructing a result bitmap of length N equal to the number of regular expression existing in the system. For the routing table example, this value is equal to 2. As illustrated in Assuming that the query word is 10.76.76.54, the first logical AND operation will take place between the result bitmap However, as illustrated in In view of the many possible embodiments to which the principles of this invention may be applied, it should be recognized that the embodiment described herein with respect to the drawing figures is meant to be illustrative only and should not be taken as limiting the scope of invention. For example, those of skill in the art will recognize that the elements of the illustrated embodiment shown in software may be implemented in hardware and vice versa or that the illustrated embodiment can be modified in arrangement and detail without departing from the spirit of the invention. Therefore, the invention as described herein contemplates all such embodiments as may come within the scope of the following claims and equivalents thereof. Patent Citations
Referenced by
Classifications
Legal Events
Rotate |